5e5c0ee845c5399b30931d144484d4ebcc66c2e5cf45f6ca122707d27f677f52

Analysis

max time kernel
121s
max time network
130s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01/06/2024, 13:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8aa75e9a013c9a6bf8744af78acbbe37_JaffaCakes118.html
Size

461KB
MD5

8aa75e9a013c9a6bf8744af78acbbe37
SHA1

3e4884ad9f21a12f719b0463d572883d1ffb5b96
SHA256

5e5c0ee845c5399b30931d144484d4ebcc66c2e5cf45f6ca122707d27f677f52
SHA512

f181ee3e313a614334f8763ce7776ccfa620c17a6492faa7ea5726497d97fee1c90c78ee3e24953262896f18afa67543ba37414dbabe58be954cbe2edeac0e87
SSDEEP

6144:SvsMYod+X3oI+YKsMYod+X3oI+YzsMYod+X3oI+YLsMYod+X3oI+YQ:W5d+X3u5d+X3h5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000d70eecb47c9ed85e6c5dc6bfd1afd0411794bcbf8ad6b90809300deaa8bce258000000000e8000000002000020000000dde0e6ca8daeedb6aeb9bfb83d6bc4012f569ec4d8e84ef533b878fa63b9fb2d900000000bd5234e1c95e4690451110e82cbf392521e9545deb110015669cdcf25ba1ef355b122d0de22cec1965cfb5485214d55d3b106253d2efd1bf4dca8945e49735bb07aa4a8dd53df202198dd30b5bbc47c7577e10e8657c311d6362b3f90eb5db7fae342582c536cab0993249ceb52675edb4f329401aa9f5858593fc8b759d65f7b394634d327a582fdfc6fbca75f2d9c4000000005f452b047633d3f0902e9da45878ace85ca82c0f9d05fb8b0fba0f294aac548f60f74fde532a13bc69a4b170e58664478ce796be1bf0dcd22b1563ff2b6278c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c086e99a2bb4da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b0000000002000000000010660000000100002000000059625ed1c2e02ca70d2a4e38076852c9d59646ddd54ce4c2b823b678c33068ad000000000e800000000200002000000070a61c53262236d658556a9a6ca3f6f7bcf14fffeaf91b20ec84121e12f7009c2000000071f2339cf5233312281c684024fce6a2852fb9b2ad611526ffe94b3a69e9050a4000000066733dff88c43d31e9c17b40d468e0e3264769ddfdd8ec0604524fd83fd8a94b17aed014996afb54c8fb410f9b2923f513bdf45dd94f4ffab268f9536a1b0df0	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423412063"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C2533F31-201E-11EF-ACD5-4635F953E0C8} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2136	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2136	iexplore.exe
2136	iexplore.exe
2924	IEXPLORE.EXE
2924	IEXPLORE.EXE
2924	IEXPLORE.EXE
2924	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 2924	2136	iexplore.exe	29
PID 2136 wrote to memory of 2924	2136	iexplore.exe	29
PID 2136 wrote to memory of 2924	2136	iexplore.exe	29
PID 2136 wrote to memory of 2924	2136	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8aa75e9a013c9a6bf8744af78acbbe37_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2136 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ce5a2aa7b455671d87d449ef36eb270c

SHA1
40f199eb72f9ba015e590f3502e02be4d425fe82

SHA256
9e57652360102a89f3d70a983241807cb7e96c93ffcc87991075e2382261b671

SHA512
af9b967f481fe711c43cf6aedc12fbf44023b883c63e986598e40511442c63ddbd2ef392c0f0a73f90f56901c30a818837bd717afd37b49f90b0b66afab7c172

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2259b1569c782ea29f58ffcb96a74d77

SHA1
d9f508e0d7194d50926e4fb706d825ff7519fa78

SHA256
ef79729bfeb4424c89d645006a3977b1024a49aceed38feeccd03b1849ee5b83

SHA512
73736e0ba73ad4ceaa5c592adbcf60641a06d7da8cd93d07613acd0c6db765e23124c2a81c8f84852465a5e47cb061027c46480edfc296ed0167e597cdf8e949

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0127d045a13892603cdc56e15d6e5aca

SHA1
875ab8810e06a1199dc6105c5dac410748fe6428

SHA256
b19542a109613de18cb3c95f94cd6bae4782b6e98048c9f4bf9b9f1ccd748a6c

SHA512
c765b1e54fc1c04cccbc0971b0e6cc946198788e67eb8dff465f75771829e7828ad74f7c88f5a5695746843320763cfe288f07a7dc0f77609afe13ecffb76e83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
68d5aab485ecd9fb39e22c39fc5a448c

SHA1
3364a3ec53904d42a4de85134da2cb0706be252a

SHA256
177c627a1ef142d9de7cd1a73600e412e0acb170b02edad96af3d0903a9c7ece

SHA512
2cbfc017d33c0db21361e63cb2aaab26f6994574fb8ff34d6d2830f5a9487b708ecda71f47f9cb6857143e013529f58bdf81fa3b06c0cde914e4c2cd0c1c7b36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e127aabfbbd28bfa1cbe1a5efdadaa20

SHA1
88a1058012b7628e5eed9ce43981eb5aea7246e6

SHA256
ba3736a6b0cc4d574d269d587c9de1da253ef9be44bc05249a43d5773bdd8a42

SHA512
ef396aa7f64f9ccdf276f47a99102357c980b6291488ff401e8814bff3c773aac64ba120c8101c07fbb9ae418fcf06499fa1908f52b1dd5c9aab562958a4cfd6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
053f9b302779de5123c349200b33c042

SHA1
e1bbfc5c8d1708a26599d8a9ff910503b9845d1c

SHA256
245380e9e1a0bfc620f82b56fbc55fd75ee871d9482da40a96a4ea45c3373dae

SHA512
d5ab68bf6ed03bd783d9a0de7ebdc5ddaabd8f38ead06e968aa10943c80fc56bf9945912b9ccdcbb4ae5c9f5c191b155805c49221056bf8621aaaa85f5d90c59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff62f6577a504067df32d5e63bf06c2d

SHA1
a25941692a310c27e5ece426965ef22423a70af0

SHA256
a2f3a623cb76b1b76148c7e9de6f8888c5f2e4c589fa6fae5bbd9c17a0533bb6

SHA512
e7c9ce52f0c2c0e336f4657a3cb01daa7c17165bcbb9589db2aa880dd9d62db6a4384f2c58c4290d722db6471322c3ad2fabfcbd4bd951a69c722808dd291d7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b275e4d43c9abd880bc879f625d1f786

SHA1
da63d54cae9b025e98778989f3f319bb35f1439d

SHA256
5bc29571af77c31635506013752d33886457b7b66fd749f369ed587a24e95bf1

SHA512
5e0d9a2f6c86d4a8bd1970c9452bb3506c40153cc2a0ae997cb51d0f197586661b37ce8399ce8a99af6393cef4350a562bee2a8849b27b197d000ae13eb4fa34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2b69446922646e29194304db41baf07b

SHA1
42cda0a896c1cc78d616aa38373e5701f89e75ce

SHA256
502a88b91c2f465be3ce9a4e301edece459954757653dfb6cd4483243db2b3fd

SHA512
1ec5fbd03be86384e26603be64c2155736ac530a65c4fb79bcafa138c2ed97b5dee872476e3235eab7fa9d68d94bc935a17f323ee40b3c025ba81a44ced69834

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b618185652b937e3f0bca9828cfa653b

SHA1
a554aeb5fea8642428816483df86de509659c382

SHA256
68e4cdcd5941bb4a9773607b937179bdce4971f4486d41acc70bae9e0daa3611

SHA512
0b0867161e50d9102cbdb8b250f6dc9a2a4fef57df4877271854c61dbd575623ae0c8c1f265ea755b27acf35434d17adea0737e8b81a8f8ab0c2e34feea3abaa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5006.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar54AF.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit